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We point out that arguments for the security of Kish's noise-based cryptographic protocol have 
relied on an unphysical no- wave limit, which if taken seriously would prevent any correlation from 
developing between the users. We introduce a noiseless version of the protocol, also having illusory 
security in the no-wave limit, to show that noise and thermodynamics play no essential role. Then 
we prove generally that classical electromagnetic protocols cannot establish a secret key between 
two parties separated by a spacetime region perfectly monitored by an eavesdropper. We note that 
the original protocol of Kish is vulnerable to passive time-correlation attacks even in the quasi-static 
limit. Finally we show that protocols of this type can be secure in practice against an eavesdropper 
with noisy monitoring equipment. In this case the security is a straightforward consequence of 
Maurer and Wolf's discovery that key can be distilled by public discussion from correlated random 
variables in a wide range of situations where the eavesdropper's noise is at least partly independent 
from the users' noise. 



Quantum key distribution pQ boasts unconditional se- 
curity even in the presence of realistic noise [2J, and 
the techniques have matured enough that small commer- 
cial implementations have been explored. However, the 
practical difficulty of manipulating individual quantum 
states has prompted some investigation into purely clas- 
sical schemes which might be able to achieve similar ends. 
In particular, Kish has proposed a strictly classical pro- 
tocol (Kirchoff Law- Johnson Noise or KLJN) on an in- 
secure transmission line using Johnson-Nyquist noise in 
resistors [3] (figure [l]) . He and collaborators claim that 
the idealized model of this protocol is unconditionally 
secure and that the prospects of real-world implementa- 
tions are promising [¥J. Intuitively, this seems dubious; 
information passing between two parties must travel as 
an electromagnetic wave over the transmission line, and 
a potential eavesdropper should be able to perfectly mea- 
sure a classical signal (regardless of its noisy origins) with 
arbitrary precision and with arbitrarily little disturbance. 

First, we note that the security of the KLJN protocol is 
only claimed in the limit where electromagnetic modes of 
finite wavelength are neglected [3]. In other words, cur- 
rents and voltages are assumed to be quasi-static. Kish 
has argued that this obviates any need to analyze waves 
moving along the transmission line [5] and he agrees in- 
tercepted waves would compromised security [5] . We be- 
lieve this no- wave limit is inappropriate and nonphysical 
for analyzing communication protocols (even as a math- 
ematical idealization) because if propagating waves are 
excluded there is no way for information to get from Al- 
ice's side of the circuit to influence Bob's side, or vice 
versa. Unfortunately this no-wave limit has formed the 
basis of subsequent claims that the idealized protocol is 
unconditionally secure 4. 5 in response to criticism [7]. 

To illustrate our critique, we depict a simplified analog 
of the KLJN protocol in figure [2] which is similarly secure 
against passive attack in the no- wave limit. Since the 



concepts of temperature and noise have been eliminated, 
they play no fundamental role in the protocol, under- 
mining the recent claim of Kish et al. that the security of 
the KLJN protocol follows from the 2nd law of thermo- 
dynamics [4]. This was already suggested by the earlier 
observation in reference [3] that artificial noise genera- 
tors were as good as true Johnson-Nyquist noise from 
resistors. 

Kish has argued that many cryptographic schemes 
(such as quantum key distribution) were initially only 
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FIG. 1. Basic KLJN protocol. Alice and Bob are at op- 
posite ends of an ideal transmission line, with Eve somewhere 
in the middle. At each clock cycle Alice and Bob decide in- 
dependently and randomly whether to terminate their end of 
the line with a low resistance (L) or a high resistance (H). The 
Johnson-Nyquist noise from these thermal resistances i?L and 
i?H at temperature T can be modeled as an ideal resistor in 
series with a voltage source undergoing Gaussian fluctuations. 
After transients resulting from this switching have died down, 
the mean square noise voltage will be the same at any point 
between Alice and Bob, having one of three values: low (for 
the LL combination), high (for the HH combination) and in- 
termediate (for LH or HL). Alice and Bob discard data from 
the HH and LL events, and keep the HL and LH data. The 
kept events are candidates for a secret key because, knowing 
their own switch settings, they can distinguish HL from LH, 
but Eve cannot do so from the mean square noise voltage on 
the transmission line. 
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analyzed as mathematical idealizations, and that the use- 
fulness of the KLJN protocol can only be assessed with a 
detailed mathematical analysis of real- world inefficiencies 
[SI IB] • Although we are sympathetic to the general idea 
that physical robustness of information systems is very 
important and often non-obvious — witness fault-tolerant 
quantum computation [3] — we emphasize that quantum 
key distribution has been shown to be robust with im- 
perfect components against very general attacks [5] while 
exploiting an unphysical limit seems to be essential to the 
KLJN protocol. We can be more precise as follows. 

Suppose that Eve makes a continuous measurement 
of the electromagnetic field on a thin cross-section of the 
transmission line (including the grounding wire) between 
times t = and t = T, denoted by the variable Z. This 
variable contains a complete history of the fields inside 
the cross-section during the interval of length T. Since 
this is a purely classical analysis, the measurement can 
be ideal. We can either (1) use the exact (or 'micro- 
scopic') version of Maxwell's equations and imagine that 
this cross-sectional plane passes between all atoms in the 
transmission line or (2) use the macroscopic version of 
Maxwell's equations and take the transmission line to 
be a continuous medium. Either way, Eve can decom- 
pose the fields into orthogonal components Z A and Zb, 
describing the waves heading toward Alice and Bob, re- 
spectively. 

Let Y be a variable that describes everything on Bob's 
side of Eve's location during the same time interval, in- 
cluding waves traveling toward him, away from him, and 
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FIG. 2. Noiseless KLJN protocol. The wires and voltage 
sources are taken to be ideal, with zero thermal noise. For 
each clock cycle, Alice randomly chooses either "L-first" or 
"H-first" . If the former, she connects the L side of her circuit 
for the first half of the clock interval, and the H side for the 
second half. (If the latter, she does the reverse.) Bob does 
likewise. If the choices are the same, then for half of the 
clock interval the voltage on the transmission line will be zero 
and that clock cycle is discarded. If the choices are different, 
then the voltage is Vo for the entire interval, regardless of who 
chose "L-first". (The transmission line can be momentarily 
re-grounded between half-clock cycles to ensure it has zero 
voltage when neither party connects a battery.) The choice is 
known to both Alice and Bob, which now forms their key bit, 
but is unconditionally secure from an eavesdropper according 
to the standards used to claim security of the original KLJN 
protocol in figure [l] Thermodynamics and noise do not play 
a role. 



all of his equipment and memory. Let X be the same 
for Alice. X, Y, and Z = (Z Ai Zb) are random vari- 
ables characterizing the distribution of possible histories 
when the protocol is run. (This captures, for example, 
the outcome of any coin flips Alice and Bob perform, as 
well as possible noise in the components.) The initial 
data on the t = surfaces of X and Y must be indepen- 
dent variables — otherwise, Alice and Bob could simply 
use them to construct a secret key — but X,Y, Z A , and 
Zq will be generally all be correlated. 

The deterministic and locally causal structure of 
Maxwell's equations ensures that Y can only be influ- 
enced by X via the intermediary Z A . This can be ex- 
pressed mathematically as 



H{X\Z A ) = H{X\Z) = H(X\Z,Y). 



(1) 



The conditional information H(S\T) denotes the un- 
certainty in S remaining when T is known. Equation ([I]) 
just says that, once Z A is known, nothing further about 
X is learned from measuring Zb or Y. This can equiva- 
lently be stated as a restriction on the joint probability 
density: 



P(x,y,z)= dzp(z)p(x\z A )p(y\zB), 



(2) 



where z — (z A , zb) and where p(z), p(x\z A ), and p{y\z&) 
are defined in the usual way from p(x,y,z). Intuitively, 
X only "knows" about Z A and so is completely specified 
by p(x\z A ). 

It follows that X — >• Z —> Y forms a Markov chain and 
that the conditional mutual information between X and 
y, conditional on Z, vanishes: 



I(X:Y\Z) = H(X\Z) - H(X\Z,Y) = 0. 



(3) 



Under this condition Alice and Bob, even with the help 
of public discussion, cannot establish a key that is secret 
from Eve [II] . That is, the distillable key rate is zero. 

This conclusion depends on Eve's ability to accurately 
measure the time history of the electromagnetic field, not 
just its instantaneous spectrum. Thus, while the steady 
state mean square noise voltage in the original KLJN pro- 
tocol (figure [T]) does not allow Eve to distinguish between 
the LH and HL settings of Alice's and Bob's resistors [3], 
she can distinguish them using either (a) transient waves 
created by the switching action before the steady state is 
established, or (b) time correlations in the steady-state 
distribution of traveling waves resulting from the fluc- 
tuations that give rise to Johnson-Nyquist noise. For 
example Bob's resistor affects the phase and amplitude 
correlations between a right-traveling wave at time t and 
its left-traveling echo at time t+A, where A is the transit 
time from Eve to Bob and back, with the echo vanishing 
only if the resistor is perfectly impedance matched to his 
end of the line. 
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FIG. 3. Key distillation from Johnson-Nyquist noise. 

Consider a static lumped circuit with resistors at finite tem- 
perature connected as in the figure. The switch for the central 
node is flipped randomly between ground and a (tiny) voltage 
Vo- Alice, Bob, and Eve see this through noisy thermal resis- 
tors Ra, Rb, and _Re, each of which applies an independent 
Gaussian offset to the voltage at the central node. Even if 
Eve's noise is less than Alice's and Bob's (e.g. if Re < Ra, 
Re < Rb, with everyone at the same temperature), Alice 
and Bob can use advantage distillation [10] to distill a secret 
key via 2-way public communication provided Re is strictly 
positive. However if Eve's measurement of the fluctuating 
voltage at the central node is noiseless (Re = 0), Alice's and 
Bob's conditional mutual information, conditioned on Eve's 
observation, is zero, and no secret key can be distilled. 

Our noiseless protocol in figure [2] with ideal compo- 
nents has no fluctuations and is not open to this passive 
steady-state attack, but of course it could be broken by 
observing the transients as the voltage was being raised 
on the transmission line from one side or the other. These 
transients are precisely the waves which carry the infor- 
mation between Alice and Bob. However, if Eve gra- 
ciously promises not to observe the transients, she could 
still learn the key by an active steady-state attack in 
which she would place a very high-resistance shunt be- 
tween her node and ground, and monitor the direction of 
current flow into it. Of course Alice and Bob could try to 
detect this weak leakage current also, and abort the pro- 
tocol if they found it. The result would be an unstable 
arms race, won by whichever side had the more sensitive 
ammeter, not the sort of robustness reasonably expected 
of a practical cryptosystem. 

It has been claimed that low-pass filters added by Alice 
and Bob in an attempt to enforce the no- wave limit would 
prevent attacks on propagating waves in KLJN systems 
[H [5]. This claim has not been quantified, and in any 
case filters added by Alice and Bob do not avoid our 
general theorem ([3| about classical electromagnetic sig- 
naling; any frequency components traveling toward Bob 
which are removed by Alice's low-pass filter before en- 
tering the public section of the transmission line are un- 
available to both Eve and Bob. 

We emphasize that so long as Eve makes perfect mea- 
surements, equation ^ holds regardless of whether X, 
Y, and Z are continuous or discrete, whether Alice 



and Bob perform deterministic or probabilistically pro- 
grammed actions specified by the protocol, and whether 
the equipment and transmission lines have loss, noise, fil- 
ters, or even memory. Therefore, the problems of finite 
resistance in the transmission line [7] or temperature dif- 
ferences between Alice and Bob [H] are moot. Attacks 
based on these imperfections become important only 
when the unphysical no-wave limit is accepted, which as 
we noted would also prevent key agreement by prevent- 
ing any information from passing between Alice and Bob 
in the first place. 

Of course, none of this shows that ideas contained in 
the KLJN protocol cannot find useful application. There 
are many classical cryptographic protocols whose secu- 
rity rests on some assumed limitation on the class of at- 
tacks available to the eavesdropper. For example, the 
last two decades have seen interest in the use of synced 
chaotic lasers for transmitting messages which cannot be 
decoded by an eavesdropper using simple measurement 
strategics. An early example relevant to key generation 
from thermal noise is the scenario illustrated in figure [3j 
where Alice, Eve, and Bob listen to the same random 
binary source through three independent Gaussian chan- 
nels, yielding variables A, B, and E. Maurer showed 
(reference [10] section V) that Alice and Bob can distill 
secret key at a positive rate even if their channels are 
more noisy than Eve's by using two-way public commu- 
nication to collaboratively agree on a subset of their data 
on which their noise is less than Eve's, even though it is 
greater than Eve's on the raw data as a whole. The key 
rate obtainable from this "advantage distillation" tech- 
nique depends on the noisiness of Eve's measurements, 
being upper bounded by the conditional mutual infor- 
mation I(A; B\E), which vanishes in the limit Re — > 0. 
Advantage distillation has been further generalized and 
developed by Maurer and Wolf [11 . For quantitative 
studies of key rates obtainable with discrete and Gaus- 
sian channels see [12] and [13] . 

In conclusion, we have shown that protocols of the 
KLJN type do not use thermodynamics in an essential 
way, and that they can be completely defeated by an 
adversary able to perfectly monitor the time-dependent 
fields in the region between Alice and Bob, as classical 
electromagnetic theory would allow. On the other hand, 
if in practice Eve's monitoring can be guaranteed to be 
finitely noisy, such protocols may yield secure key, at a 
rate not exceeding the conditional mutual information, 
using Maurer's technique of advantage distillation. 
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